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Disclosure to Promote the Right To Information 

Whereas the Parliament of India has set out to provide a practical regime of right to 
information for citizens to secure access to information under the control of public authorities, 
in order to promote transparency and accountability in the working of every public authority, 
and whereas the attached publication of the Bureau of Indian Standards is of particular interest 
to the public, particularly disadvantaged communities and those engaged in the pursuit of 
education and knowledge, the attached public safety standard is made available to promote the 
timely dissemination of this information in an accurate manner to the public. 
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FOREWORD 

This Indian Standard was adopted by the Bureau of Indian Standards, after the draft finalized by the Banking and 
Financial Services Sectional Committee had been approved by the Management and Systems Division Council. 

After the revision of IS/ISO 9001 in year 2000, its-use particularly in the Banking industry has increased. There 
is a strong need for a standard which provide guidelines to different banks in comprehending and implementing 
various requirements of IS/ISO 9001 : 2000. 

This standard is intended to fulfill this long felt need. 

For benefit of the user, the text of IS/ISO^001 : 2000 from 4 onwards has been included in box, followed by text 
giving guidance as applicable to banking industry. Wherever the words 'International Standard' appear in the 
boxed text of IS/ISO 9001 : 2000, they should be read as 'Indian Standard'. 

'Introduction* has also been included in the body of the standard which provides guidance on 'Introduction' of 
IS/ISO 9001 and also makes the structure of this standard in line with that of IS/ISO 9001. 

INTRODUCTION 

0.1 General 

The standard provides guidelines for a quality management system, which have been recognized as being aligned 
with internationally accepted good practice for banking sector. 

A quality management system aims to give confidence to the customers that the business is well run. It requires 
an organization to prove its ability to meet the customers' and any associated statutory and regulatory requirements. 
Records that show how well an organization has performed in the past may give prospective customers a high 
degree of confidence in its capabilities. 

The way the organization runs its banking business is unique. This standard gives a framework for good 
management practice that can be applied to the business. It specifies a set of things that need to be included, but 
does not say how one does them. The 'how' has to be decided by the organization as its own. Hence there is 
considerable freedom in meeting the requirements of the standard. 

A quality management system has to be built around current existing business practices. For the initial development, 
the organization will need to upgrade its practices in those areas where it does not meet the requirements. 

0.2 Process Approach 

At the heart of this standard is a conceptual model, Fig. 1, which is important for one to understand. The standard 
refers to this as a model of a process-based quality management system (see Fig. 1A) because it highlights the 
main processes that are integral to this standard. Also these processes probably exist in the organization, although 
one may not have looked at it in this particular way before. 

This model takes the view that everything to do with quality starts and ends with the customer. So the model is 
customer driven. In Fig. 1, the customer is shown on both the left and right. Most often it will be the same 
customer, but it could be a different one. 

The model starts with the needs and expectations from the customer — what the customer wants. This becomes 
an input to the quality management system (Fig. 1 shown in as a circle). This input feeds into the product and 
service planning and into service provision. 

The main process flow that enables the product and/or service to emerge is shown across the lower part of the 
figure, as product realization. This box covers the various activities that an organization needs to do to make the 
product and/or provide service. It becomes the output from the business in the form of a product and/or service. 
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Fig. 1 Model of a Process Based Quality Management System 

The model highlights the importance of obtaining information on customer satisfaction (the dotted arrow on the 
right points back to measurement, analysis and improvement). This and other measurements and evaluations 
become vital feedback on organization's performance. These measurement systems are shown as the box entitled 
measurement, analysis and improvement. 

The management responsibility box is there to explain the importance of role of top management in the quality 
management system. One needs to act on the information and data that show how well or how poorly the system 
is working and provide or adjust the resources needed to maintain and improve it. 

The model also shows the need to maintain relationships with customers to know their expectations and what the 
organization capabilities are of satisfying them. Management responsibility (see 5) covers the need to set policy 
and objectives. Following from these there is a need for proper planning. Planning includes the identification of 
processes, ensuring that they are adequately documented (see 4.2.1). These documents need to define the way we 
need to operate the processes. 

One has to ensure the availability of adequate resources to assure the quality of products and/or services. Resources 
include people, equipment, workspace and materials. It is to be ensured that people are trained and are competent 
to do the tasks assigned to them. 

The data analysis, shown in the box on the right, entitled measurement, analysis and improvement may suggest 
improvements to the quality management system, indicated as the arrow pointing to the box at the top, entitled 
continual improvement of the quality management system. 

One of the important features of IS/ISO 9001 : 2000 is the increased use of feedback as a powerful management 
tool. Feedback provides a framework for monitoring or measurement to detect as to when and where things have 
gone wrong and require attention. 

The standard requires that in addition to taking corrective actions to prevent recurrence of existing non-conformities, 
organization should also identify the potential non-conformities (not occurred so far) and, if justified, take necessary 
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steps to prevent their occurrence. Thus it emphasizes the need for identification of root causes of known/potential 
problems and their elimination in order to ensure effectiveness of corrective/preventive actions. 

Therefore, the following mandatory requirements have been in-built into the quality management system that 
will lead to continual quality improvement: 

a) Quality policy, 

b) Quality objectives, 

c) Measuring and monitoring, 

d) Internal quality audit, 

e) Analysis of data, 

f) Corrective action, 

g) Preventive action, and 
h) Management review. 

Hence the process model in Fig. 1 ties together the concepts of quality assurance to continual improvement. 

If an organization is interested in looking further into these concepts, one may read both IS/ISO 9001 and 
IS/ISO 9004. 

0.3 Relationship with IS/ISO 9004 

IS/ISO 900 1 and IS/ISO 9004 now have a common main clause structure, which simplifies using the two standards 
in conjunction with each other. IS/ISO 9001 focuses on the customer while IS/ISO 9004 goes beyond this to 
include other interested parties, namely, employees, shareholders, suppliers and society at large. However this 
standard provides guidance for IS/ISO 9001 only. 



IV 
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Indian Standard 

QUALITY MANAGEMENT SYSTEMS — 

GUIDELINES FOR IMPLEMENTATION OF 

IS/ISO 9001 : 2000 FOR BANKING INDUSTRY 

1 SCOPE 

1.1 General 

This standard provides guidelines for establishing, documenting, implementing and maintaining quality 
management system for the branches in the banking sector where they: 

a) need to demonstrate its ability to consistently provide product that meets customer and applicable 
regulatory requirements, and 

b) aim to enhance customer satisfaction through the effective application of the system, including processes 
for continual improvement of the system and the assurance of conformity to customer and applicable 
regulatory requirements. 

1.2 Application — What to do if Some Requirements of IS/ISO 9001 do not Apply to Business? 

1.2.1 Conformity to IS/ISO 9001 can only be claimed, if the rules given in 1.2 of IS/ISO 9001 are followed. 
These rules allow to exclude those requirements in 7 of IS/ISO 9001 (and only in 7), which do not apply to the 
business (that is the organization neither does not do them, nor is responsible for them) or may not apply to the 
products and/or services that are being provided, with the condition that by excluding such requirements, the 
quality of product and/or service is not affected. 

1 .2.2 Further, a requirement in 7 cannot be discarded as being irrelevant just because one does not want to do it, 
or because it is not required by statutory or regulatory bodies. 

Before excluding any requirement (in 7), just ask: 

a) Whether quality or product and/or service is being affected? 

b) What is the idea or principle behind this requirement? 

c) What kind of problem could be prevented by meeting this requirement? 

d) Would meeting the requirement give confidence to the customer? 

e) If an organization is not responsible for the requirement, Ihen who else is? 

Examples 

1) If design (see 7.3) is not carried out, then this process need not be included. 

2) If an organization does not use equipment to measure then it need not have any calibration requirement 
[see 7.6 (a)]. 

3) If the customer does not supply any property, then requirements for customer property do not apply 
(see 7.5.4). 

There may be circumstances where some specific requirements within one of the sub-clauses of 7 might need to 
be included while the rest of the requirements in that sub could be excluded. For example, items like cheque 
books, demand drafts, books and formats for various offices/branches are normally purchased by the controlling 
office. Further, evaluation of suppliers of such items is also done by controlling office or at a centralized point. 
However, purchasing indent (purchasing information) and verification of purchased product is normally done by 
the branches of the bank. Therefore, in such situations 'Purchasing process (see 7.4.1)' may not be applicable to 
the offices/branches, but 'Purchasing information (see 7.4.2)' and 'Verification of purchased product (see 7.4.3)' 
may be applicable. 

NOTE — Examples of exclusions given above only describe the spirit and may not be taken on the face of it Each organization has 
to consider exclusions specific to its own requirements. 

Any exclusion of the requirement has to be justified in the quality manual (see 4.2.2). 



IS 15650 : 2006 

2 REFERENCES 

The following standards contain provisions which through reference in this text constitute provisions of this 
standard. At the time of publication, the editions indicated were valid. All standards are subject to revision and 
parties to agreements based on this standard are encouraged to investigate the possibility of applying the most 
recent editions of the standards indicated below: 

IS No. Title 

IS/ISO 9000 : 2000 Quality management systems — Fundamentals and vocabulary (second revision) 

IS/ISO 9001 : 2000 Quality management systems — Requirements (second revision) 

IS/ISO 9004 : 2000 Quality management systems — Guidelines for performance improvements (fifth 

revision) 

IS/ISO/TR 10013 : 2002 Guidelines for developing quality manuals (first revision) 

3 TERMS AND DEFINITIONS 

3.1 Organization, Supplier and Customer 

Branch/Office, which implements IS/ISO 9001 is the 'organization'. 'Suppliers' are people or companies which 
supply products or services to the organization, and 'customers' are people or businesses who receive products 
and/or services from the organization. For example, a branch implementing IS/ISO 9001 is 'organization', its 
controlling office or these providing products and/or services 'suppliers' and 'depositors/borrowers' of the branch 
are its customers. Similarly, other branches of the same bank to whojn the branch (organization) is providing 
services are also customers of the same branch. For the controlling office, the suppliers are those, which supply 
items, like, cheque books and stationery; customers will be all the branches to whom this controlling office 
provides service. For the purpose of this standard, the definition given in IS/ISO 9000 shall apply. 

3.1.1 Of course the same relationships also apply to every organization so that in differing contexts you as an 
'organization' can, at the same time, be the 'supplier' of product and/or service to another business and the 
'customer' when receiving product from a different business. 

3. 1 .2 Product — Result of a Process 

This term is used in a generic fashion to describe: 

a) physical products, 

b) services, 

c) design output, 

d) computer software, and 

e) any other form by which a business can provide a saleable commodity or service. 

Thus, the definition of 'product' includes 'service'. However, in this standard both the terms 'product' and 
'service' have been used for better understanding. 

3.1.3 Top Management — Person or group of people who directs and controls an organization at the highest 

level. 

In banking Industry, it could be head of the branch/office which is implementing IS/ISO 9001. 

3.1.4 Continual Improvement — Recurring activity to increase the ability to fulfil requirements. 

3.1.5 Audit (Quality) — Systematic, independent and documented process for obtaining audit evidence and 
evaluating it objectively to determine the extent to which audit criteria are fulfilled. 

This may be considered as a systematic examination to find out, if the planned activities related to quality and 
associated results are consistent with those expected or planned for. 

3.1.6 Non-conformity — Non-fulfillment of a requirement. 

This term is used to describe any instance of failure to meet a specified requirement. This may be a non-fulfillment 
of a customer's requirement, a problem with a product or a service, a deficiency in the quality management 
system, or any other situation where what happened was not what was required or expected. 
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3.1.7 Infrastructure — System of facilities, equipment and services needed for the operation of an organization. 

This term covers the building, equipment, facilities and utilities needed to conduct business. Examples include 
vehicles, computers, communication systems, air conditioners, fire extinguishers, security alarm system and 
note counting machines. 

3.1.8 Work Environment — Set of conditions under which work is performed. 

This term refers to those environmental factors in the work-place that can affect the quality of the product and/or 
service. 

3.1.9 Customer Satisfaction — Customer's perception of the degree to which the customer's requirements have 
been fulfilled. 

NOTES 

1 Customer complaints are a common indicator of low customer satisfaction but their absence does not necessarily imply higher 
customer satisfaction. 

2 Even when customer requirements have been agreed with the customer and fulfilled, this does not necessarily ensure high customer 
satisfaction. 

4 QUALITY MANAGEMENT SYSTEM 



4.1 General Requirements 

The organization shall establish, document, implement and maintain a quality management system and 
continually improve its effectiveness in accordance with the requirements of this international Standard. 

The organization shall 

a) identify the processes needed for the quality management system and their application throughout the 
organization (see 1 .2), 

b) determine the sequence and interaction of these processes, 

c) determine criteria and methods needed to ensure that both the operation and control of these processes 
are effective, 

d) ensure the availability of resources and information necessary to support the operation and monitoring of 
these processes, 

e) monitor, measure and analyse these processes, and 

f) implement actions necessary to achieve planned results and continual improvement of these processes. 

These processes shall be managed by the organization in accordance with the requirements of this International 
Standard. 

Where an organization chooses to outsource any process that affects product conformity with requirements, 
the organization shall ensure control over such processes. Control of such outsourced processes shall be 
identified within the quality management system. 

NOTE Processes needed for the quality management system referred to above should include processes for management activities, 
provision of resources, product realization and measurement. 



4.1 General Requirement 

4.1.1 This clause summarizes the processes required to implement a quality management system and these are 
described in greater detail in 5, 6, 7 and 8. The clause also describes what is needed to maintain and manage the 
quality management system. 

4. 1 .2 Generally, the banks identify the key processes relating to product realization that is operational/functional 
activities and transaction {seel). This standard also requires identification of key processes of quality management 
system, for example, Management review process, Training process, Internal (quality) audit process, Customer 
satisfaction measurement process and Corrective and preventive action process. 

4.1.3 The key processes relating to service provisions may be identified in this clause. However, the description 
of the processes and further sub-processes may be included while describing 4.2.2 (c) of IS/ISO 9001. The main 
processes in any general branch may include: 
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a) Deposits, 

b) Advances, and 

c) Subsidiary services [like lockers, tax collection, Public Provident Fund (PPF), bills, clearing, etc]. 

4.1.4 For each of the above key process, the sequence and interaction of its sub-processes should be given in the 
quality manual. For effective operation and control of these processes, reference to the procedures (if documented), 
or book of instructions may be given. 

4.1.5 Regarding availability of resources and information necessary to support the operation and monitoring of 
these processes, it may be mentioned that details of these aspects have been described subsequently in relevant 
clauses. 

4.1.6 For ease of understanding, the difference between outsourcing and sub-contracting is given in 4.1.6.1 
to4.L6.3. 

4.1.6.1 What is an 'outsourced process 7 

An 'outsourced process' is a process that is provided by an external organization. 

NOTE — Clause 3.4,1 of IS/ISO 9000 defines 'process' as 'set of interrelated or interacting activities which transforms inputs into 
outputs'. 

An outsourced process can be purchased from an independent supplier, or provided by another part of a larger 
group of the organization. It may be provided within the work environment of the organization, at an independent 
site or in some other manner. 

4.1.6.2 Control of outsourced processes 

Outsourced processes typically involve interactions with other processes needed for the organization's quality 
management system. Where a process is outsourced, the organization needs to control not only the conformity of 
the output of the process, but also the process itself, including its interactions with other processes. For any 
outsourced process that affects the organization's ability to provide conforming product and/or service, the 
organization has to demonstrate that it exercises sufficient control to ensure this process is performed according 
to the relevant requirements of IS/ISO 900 1 . The nature of this control will depend on the nature of the outsourced 
process and the risk involved. Control may include, for example, a contractual agreement with the provider of 
the outsourced process including the specification of an/or validation requirements for the process, quality 
management system requirements, on-site inspections or verifications, and/or audits. 

4.1.6.3 Outsourcing versus 'Purchasing' 

Purchasing requirements as per 7.4 of IS/ISO 9001 apply to all purchased products, which typically involve a 
relatively clear interface between the organization and its supplier, and for which conformity to specified . 
requirements can be verified by inspection of the product or by other activities. 

For outsourced processes, it is often not possible, practical or economically viable to verify the conformity of the 
resulting product by subsequent monitoring or measurement. In some cases, deficiencies may become apparent 
only after the provider of the outsourced process has delivered the product and/or service to the organization's 
customer. In these cases, 4.1 of IS/ISO 9001 also applies, and the organization must ensure control not only of 
the purchased product, but also of the process that is being outsourced. 

Generally, the processes, which are outsourced by a branch/office may include credit cards, back office operations, 
outsourcing of software development, Direct selling associate for retail loan products, ATM operations, etc. 



4.2 Documentation Requirements 
4.2.1 General 

The quality management system documentation shall include 

a) documented statements of a quality policy and quality objectives, 

b) a quality manual, 

c) documented procedures required by this International Standard, 
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d) documents needed by the organization to ensure the effective planning, operation and control of its 
processes, and 

e) records required by this International Standard (see 4.2.4). 

NOTE 1 Where the term "documented procedure" appears within this International Standard, this means that the procedure is 

established, documented, implemented and maintained. 

NOTE 2 The extent of the quality management system documentation can differ from one organization to another due to 

a) the size of organization and type of activities, 

b) the complexity of processes and their interactions, and 

c) the competence of personnel 

NOTE 3 The documentation can be in any form of type or medium. 



4.2 Documentation Requirements 

4.2.1 General 

There are generally four ievels documentation in an organization: 

Level 1 Quality manual 

Level 2 Quality procedures 

Level 3 Work instructions 

Level 4 Formats 

HIERARCHICAL QMS DOCUMENTATION SYSTEM 



LEVEL 1 

(APEX MANUAL) 

LEVEL 2 

(Cross functional procedure) 



LEVEL 3 (Instructions) 



LEVEL 4 




Quality Manual (define policy) 
What? 



System Procedures (details policy) 
What, Who, Where? 



^ Activity Charts — Work Instructions, 
CRAs (How, When?) 

Forms 
Records 



IS/ISO 9001 requires documentation of the following for Quality Management System: 

a) Quality policy and quality objectives — For details, see 5.3 and 5.4.1. 

b) Quality manual — For details see 4.2.2. 

c) Six mandatory procedures for the following clauses are to be documented: 

Si No. Clause No, Procedure 



1. 


4.2.3 


Control of documents 


2. 


4.2.4 


Control of records 


3. 


8.2.2 


Internal audit 


4. 


8.3 


Control of non-conforming product 


5. 


8.5.2 


Corrective action 


6. 


8.5.3 


Preventative action 



The procedure normally includes the sequence of activities alongwith: 

i) What is to be done? 
ii) How is it to be done? 
iii) Who will do? 
iv) When it is to be done? 
v) Where it is to be done? 
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d) 



e) 



L 



The other documents (including procedures) needed by the organization particularly with respect to 
service provisions depend upon the size of the organization, type of activities, the complexity of the 
processes of the branch, competence of its personnel, advancement of technology. Therefore, the number 
of documents and their location will vary from branch to branch. Some organizations prepare separate 
documents called work instructions where 'how is it to be done' is described. Taking this into consideration 
IS/ISO 9001 has not specified any mandatory documented procedure for 7. The organization should 
prepare, maintain and control only those documents which it feels would be necessary for effective 
planning, operation and control of its processes control of its processes. 
IS/ISO 9001 requires maintenance of minimum 21 records for the following clauses. 



SI No. Clause No. 



1. 
2. 
3. 

4. 
5. 
6. 
7. 
8. 
9. 
10. 

11. 
12. 
13. 

14. 



5.6.1 
6.2.2 (e) 
7.1 (d) 

7.2.2 
7.3.2 
7.3.4 
7.3.5 
7.3.6 
7.3.7 
7.4.1 

7.5.2 (d) 

7.5.3 

7.5.4 

7.6 (a) 



15. 7.6 



16. 
17. 
18. 
19. 

20. 
21. 



7.6 
8.2.2 
8.2.4 
8.3 

8.5.2 
8.5.3 



Procedure 
Records from management review 
Records of education, training, skills and experience 

Records needed to provide evidence that the realization processes and resulting 
product meet requirements 

Records of the results of the review and actions arising from the review 
Records of design and development inputs relating to product requirements 
Records of the results of the reviews and any necessary actions 
Records of the results of the verifications and any necessary actions 
Records of the results of validation and any necessary actions 
Records of the results of changes and any necessary actions 
Records of the results of evaluations and any necessary actions arising from the 
evaluation 

Records for requirements for records 

Records for the unique identification of the product 

Records of customer property lost, damaged or otherwise found to be unsuitable 

for use 

Records of basis used for calibration or verification where calibration standards do 
not exist 

Records of validity of the previous measuring result when the equipment is found 

not to conform to requirements 

Records of results of calibration and verification 

Records of internal audit 

Records indicating person(s) authorizing release of product 

Records of the nature of non-conformities and subsequent action taken, including 

concessions obtained 

Records of the results of corrective action taken 

Records of the results of preventive action taken 



4.2.2 Quality manual 

The organization shall establish and maintain a quality manual that includes 

a) the scope of the quality management system, including details of and justification for any exclusions 
(see 1.2), 

b) the documented procedures established for the quality management system, or reference to them, and 

c) a description of the interaction between the processes of the quality management system. 



4.2.2 Quality Manual 

This standard requires that the Quality Manual of an organization to describe its Quality Management System. 
The quality manual will need to contain the detail listed in items (a) to (c) of 4.2.2 of IS/ISO 9001 which should 
address all the mandatory requirements. 

The scope of quality manual system should be clearly stated that is whether it applies to the entire branch/office, 
a number of sections or a single section within a branch/office. If any of the requirements in 7 (as per 1.2 
Application) is/are to be excluded, they do have to be listed in the quality manual together with the justification 
for its exclusion. The exclusion shall not effect quality of services to customer. 
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In addition, the following other details of quality management system may also be included such as: 

a) Description of the organization, 

b) Quality policy and quality objectives, 

c) Organization structure, 

d) Responsibility and authority, 

e) Resources available and their allocation, 

f) Procedures or their references, 

g) Process descriptions, 

h) Definitions/Abbreviations of terms used in the branch, 

j) Quality plan, 

k) List of various acts/regulations applicable, 

m) Quality Policy and Quality Objectives with measurable parameters, and 

n) References, if any. 

Quality Manual is a very useful document for its customers, employees, suppliers, share-holders as well as 
certification bodies. Some organizations almost copy IS/ISO 9001 requirements in their Quality Manual and, 
therefore, some people may feel that it is a useless document. This only shows that the Quality Manual has been 
badly written with a limited purpose of getting IS/ISO 9001 certification without emphasizing on continual 
improvement in the quality of their services. 

Further guidance on developing a quality manual is given in IS/ISO/TR 10013. 



4.2.3 Control of documents 

Documents required by the quality management system shall be controlled. Records are a special type of 
document and shall be controlled according to the requirements given in 4.2.4. 

A documented procedure shall be established to define the controls needed: 

a) to approve documents for adequacy prior to issue, 

b) to review and update as necessary and re-approve documents, 

c) to ensure that changes and the current revision status of documents are identified, 

d) to ensure that relevant versions of applicable documents are available at points of use, 

e) to ensure that documents remain legible and readily identifiable, 

f) to ensure that documents of external origin are identified and their distribution controlled, and 

g) to prevent the unintended use of obsolete documents, and to apply suitable identification to them if they 
are retained for any purpose. 



4,2.3 Control of Documents 

It is emphasized that the preparation of documents is covered under 4.2.1 of this standard whereas this 4.2.3 
refers to control of these already prepared and established documents including documents of external origin 
(for example, RBI/FEMA/IBA/ECGC, etc, Guidelines). 

A simple thumb rule to identify the difference between a 'document' and a 'record' is, that a document can be 
revised whereas a record cannot be. For example, quality manual, quality procedures, book of instructions, etc, 
are documents whereas ledgers, day books, cash books, etc are records. Documents are to be controlled as 
per 4.2.3 whereas records are to be controlled as per 4.2.4. A documented procedure has to be established as per 
the requirements of IS/ISO 900 1 . 

The standard requires that documents (both internal and external) used to define, direct and control activities that 
affect the quality management system of the branch/office, be controlled. The purpose of the document control 
is to ensure that the necessary, accurate and up-to-date documents are available to those who need them. 

Document Control covers all the requirements given in 4.2.3 (a) to (g) of IS/ISO 900 1 . This implies that how and 
by whom the documents are to be approved, reviewed, updated and re-approved (if required). Further, how and 
by whom it is ensured that the changes in the latest documents are identified, latest documents are available at the 
point of use; documents are legible and readily identifiable. 
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The current revision status of all the documents (Quality Manual, procedures, work instructions, formats, etc) is 
generally identified by establishing a master list of all these documents. The obsolete documents are normally 
suitably marked on the cover page or other appropriate pages of the documents so as to prevent their unintended 
use. These documents shall also reflect amendments in amendment sheets. The other documents requiring control, 
may include exchange control manual, details of approved suppliers, statements of regulatory requirements, 
officers specimens signature books, TT code book, branch directory, etc. 

There is a need to have a suitable system for recalling invalid or obsolete documents. This may also be accomplished 
by assigning a staff member to collect superseded documents concurrently with the distribution of the latest 
version. In larger branches/offices, this may require some form of acknowledgement of the receipt of amendments 
and re-issues, in order to ensure effective control. 

The responsibility and authority for the above actions has to be given in a documented procedure. The methodology 
of amending the documents, giving new revision status, has also to be included in this procedure. 

The relevant document should be given only to those persons who require them and all these documents should 
be identified as controlled documents. This would facilitate incorporation of amendments and necessary updation 
in relevant documents. The distribution list should also be maintained for such facilitation. 

On-line availability of documents is now a common place approach and this greatly simplifies document control. 
A system can be set up where the on-line document is the only copy of the current document and any downloaded 
copies are automatically 'uncontrolled'. 

Additional copies of controlled documents are sometimes required for temporary usage. The procedure should 
show that steps have been taken against misuse of such documents. In particular, a controlled copy should 
replace an uncontrolled document used as a routine reference. 

Regular reviews of the distribution list or read-access permissions (for on-line systems) should ensure that copies 
go to all places where the document is required. 



4.2.4 Control of records 

Records shall be established ^nd maintained to provide evidence of conformity to requirements and of the 
effective operation of the quality management system. Records shall remain legible, readily identifiable and 
retrievable. A documented procedure shall be established to define the controls needed for the identification, 
storage, protection, retrieval, retention time and disposition of records. 



4.2.4 Control of Records 

Records are special type of documents stating results achieved or providing evidence of activities performed. 

Throughout IS/ISO 9001, a number of clauses refer to record-keeping requirements, the details of which have 
been given in 4.2.1 (e). 

In addition to the 21 records required by the standard, many more records are generated by the branches which 
may include: 

a) balance books, 

b) filled-in account-opening forms, 

c) loan documents, 

d) filled-in loan application forms, etc, and 

e) filled-in daily vouchers. 

A documented procedure has to be established for proper identification, storage, protection and retrieval of such 
records. Retention times and methods of disposals for such record? should be set down in the procedure, which 
should give due attention to relevant statutory and regulatory requirements. 

Establishment of quality management system should not result in unnecessary paper work or duplication of records, 
and the first step in applying this clause should be an evaluation of existing records and the effectiveness of existing 
records keeping procedures. Not ail records generated in the organization need to be controlled. Some examples 
may include generating, special management information system reports not required for routine monitoring. 

With the rapid development of information technology, keeping of records by electronic means is becoming 
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very prevalent, and in addition to the above requirements, consideration also needs to be given to retaining a 
copy of the appropriate software to read old records. 

Responsibility for maintenance and control of records shall be clearly defined in documented procedure. 
5 MANAGEMENT RESPONSIBILITY 



5.1 Management Commitment 

Top management shall provide evidence of its commitment to the development and implementation of the 
quality management system and continually improving its effectiveness by 

a) communicating to the organization the importance of meeting customer as well as statutory and regulatory 
requirements, 

b) establishing the quality policy, 

c) ensuring that quality objectives are established, 

d) conducting management reviews, and 

e) ensuring the availability of resources. 



5.1 Management Commitment 

Top management is a person or group of people who direct and control a branch at the highest level. 

The top management's commitment towards the importance of meeting the customer as well as statutory and 
regulatory requirements is demonstrated by: 

a) DO letter; formal and informal interactions (formal meetings may be recorded); special circulars; display 
boards; news letters; reward/recognition schemes; special training's dealing with customer requirements, 
statutory and regulatory requirements; systematic approach of dealing with customers grievances. 

b) Quality Policy — It is the overall intentions and directions of a branch/office related to quality as 
formally expressed by top management (see 5.3 for further details). 

c) Quality Objectives — see 5.4. 1 , 

d) It should be ensured that management reviews records are properly maintained (see 5.6). 

e) Ensuring the availability of necessary resources (see 6). 



5.2 Customer Focus 



Top management shall ensure that customer requirements are determined and are met with the aim of enhancing 
customer satisfaction (see 7.2. 1 and 8.2. 1 ). 



5.2 Customer Focus 



This clause makes it clear that, irrespective of who actually undertakes the interaction with the customer, it is the 
responsibility of top management to make certain that customer requirements are understood and that the necessary 
resources are available. The references to 7.2.1 and 8.2.1 are pointers to what this process is expected to cover. 



5.3 Quality Policy 

Top management shall ensure that the quality policy 

a) is appropriate to the purpose of the organization, 

b) includes a commitment to comply with requirements and continually improve the effectiveness of the 
quality management system, 

c) provides a framework for establishing and reviewing quality objectives, 

d) is communicated and understood within the organization, and 

e) is reviewed for continuing suitability. 



5.3 Quality Policy 

Quality policy should be brief, branch/office specific and should adequately reflect vision/ mission of the branch/ 
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office and also a commitment for quality, customer satisfaction and continual improvement. While framing 
quality policy, the top management may inter alia consider the following: 

a) Quality policy should be clearly defined and should be consistent with the other policies of the organization. 

b) Quality policy should provide a framework for establishing and reviewing quality objectives. 

c) Quality policy should be framed in such a manner that it is flexible to change with the emerging situation. 

d) Organization should establish how the quality policy is communicated to and understood by its staff. 
Qne of the effective ways of communication for staff is to link with his role and job profile. 



5.4 Planning 

5.4.1 Quality objectives 

Top management shall ensure that quality objectives, including those needed to meet requirements for product 
[see 7.1 (a)], are established at relevant functions and levels within the organization. The quality objectives 
shall be measurable and consistent with the quality policy. 



5.4 Planning 

5.4.1 Quality Objectives 

Once quality policy is established, it has to be put into effect. For this, top management needs to establish clearly 
defined objectives that the branch aims for. 

In setting objectives, it is useful to determine a time frame (normally of short duration, say of one year) for 
achieving them. Further, quality objectives have to be documented (see 4.2.1 of IS/ISO 9001) and should be laid 
down for quality management system including products and services. 

The objectives should be measurable, realistic and achievable and should be consistent with quality policy. If an 
objective is simply 'do better', it is just a wishful thinking and not an objective. Further, if these are not realistic, 
it may be difficult to achieve them even with best of efforts, resulting in not only demotivation of the staff but 
also getting non-conformities during audits (both internal and external). Quality objectives may include: 

a) Meeting the requirements (customer, regulatory and other) for products and services, 

b) Meeting the planned schedule, 

c) Identifying opportunities for improvement, and 

d) Identifying new market opportunities. 

In addition to quality objectives for the branch/office, thisxlause requires that quality objectives also need to be 
established at appropriate functions (departments) of the branch/office. The objectives at the service delivery or 
customer interface may be simple and direct. For example; quality objectives may include: 

a) Completing the service transaction for demand draft within the prescribed time frame. 

b) Number of customer complaints in a particular period shall not exceed a prescribed level. 

At higher levels in the branch, objectives may be more complex, which may include objective of having sufficient 
staff available in the peak hours, making employees competent for the specific job, continual improvement of 
processes, adoption of latest technology, etc. 

Therefore, one should think carefully about what objectives are to be set and the time frame within which they 
have to be achieved. 

Further, the employees of the branch/office must be aware of as to how they contribute to the achievement of 
these quality objectives. 



5.4.2 Quality Management System Planning 

Top management shall ensure that 

a) the planning of the quality management system is carried out in order to meet the requirements given 
in 4.1, as well as the quality objectives, and 

b) the integrity of the quality management system is maintained when changes to the quality management 
system are planned and implemented. 

10 
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5.4.2 Quality Management System Planning 

This clause deals with planning at two levels. Firstly, planning has to be done so that quality management 
system, established within the branch/office, meets all requirements of 4.1 of IS/ISO 9001 . Most of such planning 
will be done at the initial stages of development and implementation of quality management system. However, 
additional planning may still be needed to: 

a) ensure the continued suitability, adequacy and effectiveness of quality management system, 

b) determine if any changes are needed, and 

c) determine if opportunities for improvement exist. 

The need for additional planning could also arise as a result of other activities, such as audits. 

The second level of planning is required to enable one to achieve quality objectives. Since quality objectives may 
change over time, this level of planning is likely to be on-going. 

This clause on planning further requires that any changes in quality management system have to be managed in 
such a way which ensures that quality management system continues to be effective during and after the changes. 



5.5 Responsibility, Authority and Communication 

5.5.1 Responsibility and authority 

Top management shall ensure that responsibilities and authorities are defined and communicated within the 
organization. 



5.5 Responsibility, Authority and Communication 

5.5.1 Responsibility and Authority 

Top management needs to ensure that everyone knows: 

a) What he is expected to do (responsibility), 

b) What he is allowed to do (authority), and 

c) That he understands how these responsibility and authority relate to each other. 

The description of responsibilities and authorities should not leave any ambiguities where there is interaction 
between people. Further, descriptions should not be elaborate or complex. It is important that the descriptions 
clearly reflect the real life situation and allow for flexibility. 

For this purpose, job descriptions or an organization chart may be needed, which may be included in the quality 
manual. Other methods, office order register or job assignment register, etc, which suit the way of working, 
could be equally satisfactory, provided that the responsibilities and authorities are communicated to and understood 
by those involved. In a small branch/office, where there are limited number of people available to carry out the 
tasks required in this clause, there will frequently be a need to plan for sharing duties and responsibilities and for 
people to be able to do each other's jobs. Such plans will be valuable during exigencies. 



5.5.2 Management representative 

Top management shall appoint a member of management who, irrespective of other responsibilities, shall 
have responsibility and authority that includes 

a) ensuring that processes needed for the quality management system are established, implemented and 
maintained, 

b) reporting to top management on the performance of the quality management system and any need for 
improvement, and 

c) ensuring the promotion of awareness of customer requirements throughout the organization. 

NOTE The responsibility of a management representative can include liaison with external parties on matters relating to the quality 
management system. 



5.5.2 Management Representative 

Top management has to nominate someone from its management with authority and responsibility for establishing 

11 
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and effectively implementing quality management system. This person may carry out other duties as well, but 
has to ensure that the quality management system is working properly. This person should be a manager/senior 
official in a branch. This responsibility and authority cannot be assigned to someone outside the organization. 

In a small branch, it may be appropriate for the manager himself to assume this role. A key duty of the management 
representative is to be aware of the performance of the quality management system and possibilities for improvement. 

Management representative is also responsible for ensuring that employees in branch/office are aware of what 
the customer wants. This means that the management representative needs to know that people have been informed 

(see 5.5.3). 

It is desirable that an MR has the knowledge of IS/ISO 9001 standards. 

A formal appointment letter clearly describing duties and responsibilities of MR as per 5.5.2 above shall be given 
to MR. It is desirable that MR's appointment is made known to entire staff. 



5.5.3 Internal communication 

Top management shall ensure that appropriate communication processes are established within the organization 
and that communication takes place regarding the effectiveness of the quality management system. 



5.5.3 Internal Communication 

For effective implementation of quality management system, good communication is essential. Such processes 
should be established which encourage employees to communicate at all levels of the business, without fear of 
being penalized as the bearer of bad news. 

To be effective, communication processes should provide branch/office and its employees the ability to: 

a) Transmit and receive information quickly and to act on it, 

b) Build trust amongst each other, 

c) Transmit thfe importance of customer satisfaction process performance, etc, 

d) Identifying business opportunities, and 

e) Identify opportunities for improvement. 

All information should be clear and understandable to the person it is intended for. 

Some examples of communication methods include posting information on bulletin boards, holdinjg meetings or 
circulation of information via office notes, circulars, electronic media (for example e-mail), intranet, etc. 



5.6 Management Review 

5.6.1 General 

Top management shall review the organization's quality management system, at planned intervals, to ensure 
its continuing suitability, adequacy and effectiveness. This review shall include assessing opportunities for 
improvement and the need for changes to the quality management system, including the quality policy and 
quality objectives. 

Records from management reviews shall be maintained (see 4.2.4). 

5.6.2 Review input 

The input to management review shall include information on, 

a) result of audits, 

b) customer feedback, 

c) process performance and product conformity, 

d) status of preventive and corrective actions, 

e) follow-up actions from previous management reviews, 

f) changes that could affect the quality management system, and 

g) recommendations for improvement. 

12 
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5.6.3 Review output 

The output from the management review shall include any decisions and actions related to 

a) improvement of the effectiveness of the quality management system and its processes, 

b) improvement of product related to customer requirements, and 

c) resource needs. 



5.6 Management Review 

The top management must review the quality management system on a regular basis. Initially, this review 
should be done more frequently (preferably once in a month) till quality management system is established 
and effectively implemented. Thereafter, this frequency may be reduced (for example, minimum once in a 

quarter). 

Top management must chair this meeting. Senior officials, who are able to contribute and take actions on the 
outcome of the meeting, should be the members of this committee. Management representative normally acts as 
the member-secretary. 

Generally, agenda for this review meeting is prepared (by management representative) and circulated to all the 
members in advance. This agenda must include information on the following: 

a) Relevance of quality policy and objectives to current needs; 

b) How the quality management systems is working and whether objectives are being met; 

c) Analysis of process performance; 

d) Quality problems and actions taken; 

e) Customer feedback, including customer complaints; 

f) Quality audit reports (both internal and external); 

g) Areas for improvement/changes needed; 

h) Outstanding actions from previous reviews, and 

j) Any changes that could affect quality management systems. 

Every individual problem should be dealt as and when it occurs. If one waits for the next management 
review to deal with a customer complaint, one might no longer have any customers. The management 
review is intended to see if the same problems recur, if the action taken is appropriate, and if the customers 
are satisfied. 

Top management should also analyze and decide on significant trends. One should not waste time in the 
management review meetings discussing relatively insignificant problems again and again. It shall be very focused 
and well structured and shall reflect a definitive action plan. The management review will be more useful if it 
carefully considers reports to obtain a clear overview and does not just review a list of small details. 

The analysis of data as required by 8.4 of IS/ISO 9001 should also be included in the management review. Other 
inputs, which may be considered, include: 

a) Training needs, 

b) Supplier problems, 

c) Equipment needs and maintenance, and 

d) Review of resources (human resources/work environment/infrastructure). 

By identifying the issues to go under these headings, and depending on the outcome of the review, one might be 
able to further develop and revise its own quality, strategic and business plans for future activities. 

The method of carrying out the review should suit the business practices and may consist of: 

a) Formal face-to-face meetings with an agenda, minutes and formally identified action points, 

b) A variant of the above by teleconferencing, or Intranet links, or 

c) Partial reviews at various levels within an organization, reporting to top management who reviews the 
reports. 

13 
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Records of the review need to be kept which address all points of the review, together with any action to be taken, 
target dates allotted to the identified officials. 

The records may be in any form that suits the business, such as formal meeting minutes or notes, which can be 
produced, distributed and stored on paper or electronically (computer data). 

Some decisions as a result of the review have to be taken in the meeting and these have to be implemented. This 
does not mean that every review decisions need to be made in accordance with items (a), (b) and (c) of 5.6,3 of 
IS/ISO 9001. What it means is when such improvements are justified, you need to decide how they are to be 
implemented, based on the available resources. 

6 RESOURCE MANAGEMENT 



6.1 Provision of Resources 

The organization shall determine and provide the resources needed: 

a) to implement and maintain the quality management system and continually improve its effectiveness, 
and 

b) to enhance customer satisfaction by meeting customer requirements. 



6.1 Provision of Resources 

Determination of resources is normally done at the branch/office level. The following factors may be considered 
in this regard: 

a) Business development plans, 

b) Requirements of quality management system, and 

c) Customer expectations. 

The provision of resources is predominantly done at the apex level, for example, zonal level based on assessment 
done at the branch/office level. However, the information regarding the provision of resources at branch/office 
level should be available. 



6.2 Human Resources 

6.2.1 General 

Personnel performing work affecting product quality shall be competent on the basis of appropriate education, 
training, skills and experience. 



6.2 Human Resources 

6.2.1 General 

The human resources are available with the branch/office based on education, training, skills and experience 
within the framework and guidelines provided by apex level. However, the competence level of the 
human resources is evaluated periodically to assess training needs and to decide appropriate job allocation 
in order to ensure quality management system is implemented and maintained and customer satisfaction is 

enhanced. 



6.2.2 Competence, awareness and training 

The organization shall: 

a) determine the necessary competence for personnel performing work affecting product quality, 

b) provide training or take other actions to satisfy these needs, 

c) evaluate the effectiveness of the actions taken, 

d) ensure that its personnel are aware of the relevance and importance of their activities and how they 
contribute to the achievement of the quality objectives, and 

e) maintain appropriate records of education, training, skills and experience (see 4.2.4). 

14 
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6.2.2 Competence, Awareness and Training 
At the branch/office level, the following factors should be considered to determine the need for competence: 

a) Existing and future requirements; 

b) Anticipated management and work force succession needs; 

c) Changes to the organization's processes, tools and equipment; 

d) Evaluation of the competence of individual people to perform defined activities; and 

e) Statutory and regulatory requirements and standards effecting the organization and its interested 
parties. 

At the branch/office level necessary competence may be determined based on defined criteria such as work 
experience, qualification, job knowledge, skills, aptitude, performance, etc. Training needs should be assessed 
based on the factors like job requirements, future needs, level of competence; and provision of training should be 
made. Generally training nominations for branch are done at apex level. However, branches can always assess 
training needs and recommend names to apex level. The effectiveness of training should be evaluated and reflected 
in the competence level. A suggestive example is given in Annex A. 

It should be ensured that personnel are aware of the relevance and importance of their activities and responsibilities 
and their contribution to quality objectives. 

Proper records of education, training, skills and experience should be maintained. 



6.3 Infrastructure 

The organization shall determine, provide and maintain the infrastructure needed to achieve conformity to 
product requirements. Infrastructure includes, as applicable: 

a) buildings, workspace and associated utilities, 

b) process equipment (both hardware and software), and 

c) supporting services (such as transport or communication). 



6.3 Infrastructure 

The infrastructural requirements at branch/office level are determined and provided at the apex level keeping in 
view the factors such as: 

a) Needs, expectations and convenience of the customer, 

b) Safety and security including branch/office premises and customer property, 

c) Layout requirements for operational efficiency, 

d) Location factors, prospects and profile of the clientele and environment, and 

e) Corporate/statutory/regulatory requirements. 

These requirements may include buildings; work space and associated utilities; process, safety, security, monitoring 
and communication equipment; and support services. The branch/office should however ensure that infrastructure 
is preserved and maintained to achieve conformity to the product and/or service requirement. 



6.4 Work Environment 

The organization shall determine and manage the work environment needed to achieve conformity to product 
requirements. 



6.4 Work Environment 

The branch/office should ensure that work environment has a positive influence on motivation, satisfaction and 
performance of people in order to enhance the performance of the organization. The following factors should be 
considered to determine and manage the work environment: 

a) Hygiene, cleanliness and pollution, 

b) Facilities for people including customers, and 

c) Safety and security requirements. 

15 
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7 PRODUCT REALIZATION 



7.1 Planning of Product Realization 

The organization shall plan and develop the processes needed for product realization. Planning of product 
realization shall be consistent with the requirements of the other processes of the quality management system 

In planning product realization, the organization shall determine the following, as appropriate: 

a) quality objectives and requirements for the product; 

b) the need to establish processes, documents, and provide resources specific to the product; 

c) required verification, validation, monitoring, inspection and test activities specific to the product and the 
criteria for product acceptance; and 

d) records needed to provide evidence that the realization processes and resulting product meet requirements 
(see 4.2.4). 

The output of this planning shall be in a form suitable for the organization's method of operations. 

NOTE 1 A document specifying the processes of the quality management system (including the product realization processes) and 

the resources to be applied to a specific product, project or contract, can be referred to as a quality plan. 

NOTE 2 The organization may also apply the requirements given in 7.3 to the development of product realization processes. 



7.1 Planning of Product Realization 

The branch should plan and estabKsh/develop processes needed for product realization, in other words, a product 
(defined as a service for banking sector) plan should be developed to include the following ensuring that the plan 
is consistent with requirements of other processes of the quality management system, namely processes for 
management activity, provision of resources and measurement: 

a) The branch activities should be identified and each activity should be defined in terms of a process. The 
requirements for the product should be defined in terms of services available to the customer and the 
quality objectives must be clearly spelt out for each of these services. For example, deposits, loans, 
lockers, remittances, etc, are some of the basic services provided to the customer. And the quality 
objectives for these services may be defined in terms of service parameters/time norms/delivery 
expectations, etc. For example, for loans, timely disposal of loan applications; for bills, timeframe for 
collection of instruments; etc. 

b) Each process in the branch should be defined and established in terms of procedure or flow chart with 
detailed description of the documents and the resources required for execution of the process. It must be 
ensured that interrelation of the processes should be clearly spelt in the relevant procedure or the flow 
chart. For example, the process of deposit accounts should have procedures or flow chart relating to all 
the deposit transactions, viz. account opening, closing of account, transfer of account, issue of cheque 
book and pass book, stop payment operations, withdrawal and payment operations, etc, and should 
have the description of different stationery forms, documents and records being used. It shall also have 
inter-linkage or cross-referencing to other service transactions viz. cash receipt payments, issue of draft, 
clearing, etc. 

c) The process as defined in procedure or the flow chart should also include verification/authorization 
stages (checks, balances and controls needed for verification and monitoring), service parameters, 
guidelines (including statutory and legal requirements) and acceptance criteria for performance. For 
example, for issue of Demand Draft, the procedure or flow chart should include the stages of verification/ 
authorization done ty the officer, delegated power, signing power, guidelines on issue against cash (as 
an acceptance criteria), etc. 

d) The procedure or flow chart should also comprehensively include the records (manual or electronic 
media) to provide evidence that process has been executed to meet the requirements. For example, in 
case of process relating to account opening, the records may include account opening forms, specimen 
signature cards, account opening files relating to documentary formalities, viz., address proof, Form 60/ 
PAN number, etc. 
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7.2 Customer-Related Processes 

7.2.1 Determination of requirements related to the product 

The organization shall determine: 

a) requirements specified by the customer, including the requirements for delivery and post-delivery 
activities, 

b) requirements not stated by the customer but necessary for specified or intended use, where known, 

c) statutory and regulatory requirements related to the product, and 

d) any additional requirements determined by the organization. 



7.2 Customer-Related Process 

7.2.1 Determination of Requirements Related to Product 

a) The branch should ascertain and determine the requirements of the customer for delivery of services 
and also for post-delivery activities. For example, the branch should discuss with the customer and 
determine all his requirements for sanctioning of loan and also for any post-sanction services. 

b) The requirements should also include implied requirements not stated by the customer but necessary for 
intended use or an integral part of the service delivery. 

c) The branch should also ascertain statutory and regulatory requirements or any additional internal 
requirements of the bank relating to the service. 



7.2.2 Review of requirements related to the product 

The organization shall review the requirements related to the product. This review shall be conducted prior to 
the organization's commitment to supply a product to the customer (e.g. submission of tenders, acceptance of 
contracts or orders, acceptance of changes to contracts or orders) and shall ensure that: 

a) product requirements are defined, 

b) contract or order requirements differing from those previously expressed are resolved, and 

c) the organization has the ability to meet the defined requirements. 

Records of the results of the review and actions arising from the review shall be maintained (see 4.2.4). 

Where the customer provides no documented statement of requirement, the customer requirements shall be 
confirmed by the organization before acceptance. 

Where product requirements are changed, the organization shall ensure that relevant documents are amended 
and that relevant personnel are made aware of the changed requirements. 

NOTE In some situations, such as internet sales, a formal review is impractical for each order. Instead the review can cover relevant 
product information such as catalogues or advertising material. 



7.2.2 Review of Requirements 

The branch should completely review the requirements for clarity/unambiguity, checking against regulations 
and guidelines, statutory or internal. The branch should also review the requirements to ensure that the branch 
has capability and authority to meet the requirements in terms of resources, equipment or authorization, for 
example, capability in terms of issue of TT, transacting foreign exchange business, etc. 

As regards amendments, review is done to ensure that: 

a) Bank/branch has necessary capabiiity/ability/authorization to accept the amendment. 

b) The amendments are checked for authority and clarity and properly executed/recorded. 

c) It is done in the same manner as for a new contract and duly approved by authorized personnel. 

d) Statutory/internal regulations/guidelines are duly met. 

The concerned personnel should be duly communicated about amendments. As regards customers, statutory 
guidelines should be communicated/made known before acceptance. 
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7.2.3 Customer communication 



The organization shall determine and implement effective arrangements for communicating with customers 
in relation to: 

a) product information; 

b) enquiries, contracts or order handling, including amendments; and 

c) customer feedback, including customer complaints. 



7.2.3 Customer Communication 
The arrangements include: 

a) Letters and correspondence, 

b) Personal discussions/interactions, 

c) Brochures/pamphlets, 

d) Customer meet, 

e) Customer service committee meeting, 

f) Display boards, 

g) Customer feedback, 

h) Customer grievances/complaints, 

j) Advertisements and notices in print/visual media, 

k) Citizen charter, and 

m) Website. 



7.3 Design and Development 



7.3 Design and Development 

This clause is not generally applicable in the case of branch of a bank as no product is designed or developed at 
this level. However, this clause may be applicable, if designing and development is being done at the branch 
level. In such cases, this clause shall be described as given in the following paragraphs: 

In the banking sector, design and development relates to new products developed, changing the structure of the 
existing product to meet customer needs/expectations or other Statutory and Regulatory requirements or any 
corrective/preventive actions based on feedback from market. 

Basically there are deposits, advances and fee based products. Apart from this in-house development of software 
requirements to both administrative and operational areas for example, packages for administrative support 
systems in areas such as clearing, accounts section, recovery, credit appraisal and monitoring, salary, income 
tax, staff matters (LFC, leave, TA bills), etc. In training activities, designing and development of training 
programmes to be conducted in-house by Staff Training Colleges are involved. Towards all these activities 
Banks have to plan for design and development stages prior to design activities. This shall be a part of project 
management plan and a project plan and review report is to be prepared. 



7.3.1 Design and development planning 

The organization shall plan and control the design and development of product. During the design and 
development planning, the organization shall determine 

a) the design and development stages, 

b) the review, verification and validation that are appropriate to each design and development stage, and 

c) the responsibilities and authorities for design and development. 

The organization shall manage the interfaces between different groups involved in design and development to 
ensure effective communication and clear assignment of responsibility. 

Planning output shall be updated, as appropriate, as the design and development progresses. 
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7.3. 1 Design and Development Planning 

The banks should plan the design and development stages prior to design activities. This shall be either part of 
project management plan or it can be a separate attachment but to be reflected in project plan and review report 
as this is necessary to synchronize the design and development review with the different stages. Proper 
responsibility and authority is to be assigned at every stage. 

The inputs to design and development shall include functional and performance requirements so as to meet 
customer needs and expectations. For example if a deposit product or advances product or design is to be planned 
(for new product or modification of existing product) then bank should take into account the life cycle, safety 
and health, testability, usability, user friendliness, identified risks apart from ensuring that it gets integrated with 
the existing process system. Bank will take into consideration statutory and other regulatory requirements such 
as IBA, RBI, FEMA, etc. 

Information about previous similar designs which may be done but not implemented can be used for preventive 
and corrective actions in new development. Inputs shall have complete clarity without ambiguities so that there 
is no conflict with each other or with other existing products in market of the Bank. 



7.3.2 Design and development inputs 

Inputs relating to product requirements shall be determined and records maintained (see 4.2.4). These inputs 
shall include: 

a) functional and performance requirements, 

b) applicable statutory and regulatory requirements, 

c) where applicable, information derived from previous similar designs, and 

d) other requirements essential for design and development. 

These inputs shall be reviewed for adequacy. Requirements shall be complete, unambiguous and not in conflict 
with each other. 



7.3.2 Design and Development Inputs 

In banking industry design inputs relating to product mean, applicable statutory and regulatory requirements, 
results of any contract review activities, customer needs, market needs, etc. Normally the unstated expectation of 
customer and market needs are more critical to the design. Some other requirements may include market surveys, 
legal requirements, indenting, practice and standards and past experience, if any. The design input shall ensure 
that the design is reviewed for coverage of the functionality, performance and other applicable statutory and 
regulatory requirements of the package/product. For example, if a retail product is being developed say for 
financing of purchase of cars, then inputs can be market surveys relating to trends in purchase/sale of cars, tie-up 
arrangements with dealers if any, time frame of finance, statutory and regulatory requirements in terms of 
repayments, etc, can be inputs to design. 



7.3.3 Design and development outputs 

The outputs of design and development shall be provided in a form that enables verification against the design 
and development input and shall be approved prior to release. 

Design and development outputs shall: 

a) meet the input requirements for design and development, 

b) provide appropriate information for purchasing, production and for service provision, 

c) contain or reference product acceptance criteria, and 

d) specify the characteristics of the product that are essential for its safe and proper use. 



7.3.3 Design and Development Outputs 

Design and development output in case of bank is the actual product itself, that is, the documented version of the 
features of the product and its delivery. 
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7.3.4 Design and development review 

At suitable stages, systematic reviews of design and development shall be performed in accordance with 
planned arrangements (see 7.3.1) 

a) to evaluate the ability of the results of design and development to meet requirements, and 

b) to identify any problems and propose necessary actions. 

Participants in such reviews shall include representatives of functions concerned with the design and 
development stage(s) being reviewed. Records of the results of the reviews and any necessary actions shall be 
maintained (see 4,2.4). 



7.3.4 Design and Development Review 

Design review is the formal checking of the design to confirm its adequacy to meet the customer needs and other 
design inputs, to identify problems and to develop solutions. Normally in Banking the design is simple and only 
one review is sufficient unless it is for software development where review is made at each and every stage of 
development. 

At each design review representatives of all functions concerned, specialist personnel and people who v»U be 
involved in delivering the product/service also are to be present. 

Normally in banking products/service, design review, design verification/testing and design validation will overlap 
and there is considerable inter-relation between them. In many instances an activity will be relevant to all three 
requirements. A simplified diagram of relationship between design review, design verification and design validation 
is shown in Fig. 2. 



DESIGN REVIEW 



USER 
NEEDS 



DESIGN 

INPUT 



DESIGN 
PROCESS 



DESIGN 
OUTPUT - 
PRODUCT 
ITSELF 



• PILOT IMPLEMENTATION 

• TESTING 

• VERIFICATION 

• VALIDATION 



Fig. 2 Relationship Between Design Review, Design Verification and Design Validation 



7.3.5 Design and development verification 

Verification shall be performed in accordance with planned arrangements (see 7.3. 1) to ensure that the design 
and development outputs have met the design and development input requirements. Records of the results of 
the verification and any necessary actions shall be maintained (see 4.2.4). 



7.3.5 Design and Development Verification 

Verification is done only through pilot implementation of product/service/package/training module. In this in 
addition to conducting reviews, verification is to include activities such as 
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a) Performing alternative calculation; 

b) Comparing new design with a similar proven design, if available; 

c) Undertaking tests and demonstration; and 

d) Reviewing documents of the product such as user manual, etc, before release. 

In software development configuration management process is involved. 

In training this may be done through conducting session under stimulated conditions. 



7.3.6 Design and development validation 

Design and development validation shall be performed in accordance with planned arrangements (see 7.3.1) 
to ensure that the resulting product is capable of meeting the requirements for the specified application or 
intended use, where known. Wherever practicable, validation shall be completed prior to the delivery or 
implementation of the product. Records of the results of validation and any necessary actions shall be maintained 
(see 4.2.4). 



7.3.6 Design and Development Validation (Testing) 

Design validation is performed to ensure that the product conform to defined user needs and/or requirements. 
This is also done through pilot implementation before the actual release of product/services/package/module. 
Validation at the pilot branch is done as per the process described in project plan and review Report prepared and 
feedback is received from the user in an informal/formal format. 

Validation is performed under defined operational condition. It is normally performed on the final product. 
Multiple validations may be performed if there are different intended user. 

NOTE — In design and development of banking products/services, the product is the design itself. For example, a car loan product. 
In all types of products verification/testing/validation of the total performance range cannot be achieved until actual condition 
occurs. Hence in Banking all these activities are done at the pilot implementation stage. A simple process flow charts for design and 
development of product/services (advances, deposits and fee based services, Software development is given in Fig. 3 and Fig. 4. 



7.3.7 Control of design and development changes 

Design and development changes shall be identified and records maintained. The changes shall be reviewed, 
verified and validated, as appropriate, and approved before implementation. The review of design and 
development changes shall include evaluation of the effect of the changes on constituent parts and product 
already delivered. 

Records of the results of the review of changes and any necessary actions shall be maintained (see 4.2.4). 



7.4 Purchasing 

7.4.1 Purchasing process 

The organization shall ensure that purchased product conforms to specified purchase requirements. The type 
and extent of control applied to the supplier and the purchased product shall be dependent upon the effect of 
the purchased product on subsequent product realization or the final product. 

The organization shall evaluate and select suppliers based on their ability to supply product in accordance 
with the organization's requirements. Criteria for selection, evaluation and re-evaluation shall be established. 
Records of the results of evaluations and any necessary actions arising from the evaluation shall be maintained 
(see 4.2.4). 



7.4 Purchasing 
7.4.1 Purchasing Process 

Any bank generally requires following items/services: 
a) Physical Items: 

1) All security stationery like pay orders, cheque books, demand drafts, etc, which are being supplied 
directly by the controlling office of the bank. 
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22 



IS 15650 : 2006 



User requirement Specification 



System requirement specification 



i 



Design 



i 



Development 



Code walk 



Test plan 



i 



Unit test 



Integration test 



User manual 



Acceptance testing 



Installation in production 



User training 



Acceptance 

; 

Documentation 



Fig. 4 Process Flow for Software Development Life Cycle 



23 



IS 15650 : 2006 

2) Ledgers, registers and critical/important printed stationery of use in the branch, which are generally 
being provided by controlling office of the branch. 

Therefore, the bank has got no discretion to buy the items at 1) and 2) from any other supplier. 

3) Miscellaneous purchases — Almirah, note counting machine, ACs, PCs, peripherals and 
consumables, fire-fighting equipment, security alarm system, ultraviolet lamps, fax machine, etc. 
The branch may procure these themselves through suppliers selected and evaluated by the controlling/ 
branch office or given by the controlling office or are directly supplied by the controlling office 
itself. 

b) Services purchased — Various services being taken by the branch, with the approval of controlling 
branch, may include AMCs, insurance, legal, civil contracts, valuers, architect, house-keeping, security, 
courier, transportation, audit, etc. 

The powers at branch level for purchases are limited. They are generally regulated at controlling office level. 
Branches can always select and evaluate suppliers for purchases within their powers. As regards purchases 
under powers of controlling office, branches shall seek permission for selection of suppliers either based on 
quotations or from approved list. Evaluation can be done by branches for such suppliers to provide feedback 
to controlling office as regards their performance. Continuous re-evaluation of these suppliers should be done 
by the branch office and feed back received from the branch regarding the non-conformities and their criticality 
may be used as one of the inputs at controlling office level. The general criteria adopted for selection/evaluation 
of supplier may be based on the important parameters like quality, delivery, cost, serviceability, market 
credibility/status, turnover, track record, proximity, the supplier's awareness about statutory and regulatory 
requirements etc. 

The degree of control exercised on the suppliers will vary with the criticality of the item or the services and its 
impact on the delivery of services. 



7.4.2 Purchasing information 

Purchasing information shall describe the product to be purchased, including where appropriate 

a) requirements for approval of product, procedures, processes and equipment, 

b) requirements for qualification of personnel, and 

c) quality management system requirements. 

The organization shall ensure the adequacy of specified purchase requirements prior to their communication 
to the supplier. 



7.4.2 Purchasing Information 

The purchasing information may include, complete information regarding product/service to be purchased in the 
precise and concise terms so that there is no ambiguity about the product/service being purchased. 



7.4.3 Verification of purchased product 

The organization shall establish and implement the inspection or other activities necessary for ensuring that 
purchased product meets specified purchase requirements. 

Where the organization or its customer intends to perform verification at the supplier's premises, the 
organization shall state the intended verification arrangements and method of product release in the 
purchasing information. 



7.4.3 Verification of Purchased Product 

Verification of purchased product at the supplier premises is generally not applicable here. On receipt of the 
product at the branch, the verification of this product should be done as per the purchase order based on the 
criticality of the characteristics. The verification of service procured would also be included here to ensure their 
compliance as per requirement. This will also include maintenance of register and records. For example, in the 
case of annual maintenance contract (AMC) it will involve maintenance of AMC register, verification/monitoring 
of AMC services, etc. 
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7.5 Production and Service Provision 

7.5.1 Control of production and service provision 

The organization shall plan and carry out production and service provision under controlled conditions. 
Controlled conditions shall include, as applicable 

a) the availability of information that describes the characteristics of the product, 

b) the availability of work instructions, as necessary, 

c) the use of suitable equipment, 

d) the availability and use of monitoring and measuring devices, 

e) the implementation of monitoring and measurement, and 

f) the implementation of release, delivery and post-delivery activities. 



7.5 Production and Service Provision 

7.5.1 Control of Production and Service Provision 

The various provisions of this clause may include the following: 

a) The various services being provided by a branch includes cash, savings and current accounts, term 
deposits, recurring deposits, loans, lockers, remittances, etc. The information on the various characteristics 
of, for example, loan schemes may include: 

1) Eligibility criteria, 

2) Repayment period, 

3) Rate of interest, and 

4) Any other terms and conditions of the loan. 

b) Availability of work instruction may be ensured as per the manual of instruction and circulars issued by 
RO/ZO/HO or RBI from time-to-time. 

c) The use of suitable equipment may include computer, printer, air conditioners, etc. 

d) This being a service industry, the use of measuring device is limited as compared to manufacturing 
industry. However, the availability and use of monitoring and measuring device may include note- 
counting machine, ultraviolet lamp, scanning of signatures, etc. 

e) The implementation of measurement may include collection and analysis of data on processing time for 
different transactions and monitoring may cover technical verification of completeness and correctness 
of banking transactions. 

Examples: 

1) In the case of demand draft, to check availability of correct: 
i) date, 

ii) amount in words and figures, 

iii) signatures of appropriate authority alongwith their ID/signature number, and 

iv) code number of issuing and drawee bank branch. 

2) In the case of account opening, to check: 
i) photographs of the applicant, 

ii) proof of residence, and 
iii) PAN/Form 16, etc. 

f) The implementation of release, delivery and post delivery activity may include the following, for 
example: 

1) Release — Acknowledgement of demand draft given/released, cheque book issued; in case of cash, 
receipt of counter foil, etc. 

2) Delivery — Release and sanction of loan; despatch of ATM card; Smart card; statement of account 
by post, etc. 

3) Post delivery — In case of cash credit account, after sanctioning of loans, calculation of drawing 
power on the basis of stock statement and thereafter release of funds accordingly. 
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7.5.2 Validation of processes for production and service provision 

The organization shall validate any processes for production and service provision where the resulting output 
cannot be verified by subsequent monitoring or measurement. This includes any processes where deficiencies 
become apparent only after the product is in use or the service has been delivered. 

Validation shall demonstrate the ability of these processes to achieve planned results. 

The organization shall establish arrangements for these processes including, as applicable 

a) defined criteria for review and approval of the processes, 

b) approval of equipment and qualification of personnel, 

c) use of specific methods and procedures, 

d) requirements for records (see 4.2,4), and 

e) revalidation. 



7.5.2 Validation of Processes for Production and Service Provision 

This may include, for example, a loan after being sanctioned, not turning into a NPA. The process would require 
validation of the various processes to ensure that there are no loopholes, which can be exploited through willful 
actions, thereby resulting in a loan being turned into NPA. 



7.5.3 Identification and trace ability 

Where appropriate, the organization shall identify the product by suitable means throughout product realization. 

The organization shall identify the product status with respect to monitoring and measurement requirements. 

Where traceability is a requirement, the organization shall control and record the unique identification of the 
product (see 4.2.4). 

NOTE In some industry sectors, configuration management is a means by which identification and traceability are maintained. 



7.5.3 Identification and Traceability 

The banks have a good system of identification and traceability. Various saving and current accounts in a bank 
are uniquely identified by account numbers issued to their customers. Similarly, term deposits are identified by 
deposit receipt number, Lockers by Locker number, Cheque books by account number of the holder, signature of 
the officers of the bank by their ID numbers. These help the bank in establishing the unique identity of the 
customers etc. and also helps in their easy traceability. All these numbers are required as per the system requirement. 
The identification of services (product) status may include, for example: (a) passing of a cheque is identified by 
cancellation of signature of drawer; passing signature of appropriate authority and payment stamp, etc; (b) the 
sanction or rejection of loan is identified by sanctioning authority's remarks and signature. Other examples can 
include status of account opening (verification of required formalities and signature of authorized official), issue 
of surrendered lockers (verification as regards key change), etc. 



7.5.4 Customer property 

The organization shall exercise care with customer property while it is tinder the organization's control 
or being used by the organization. The organization shall identify, verify, protect and safeguard customer 
property provided for use or incorporation into the product. If any customer property is lost, damaged or 
otherwise found to be unsuitable for use, this shall be reported to the customer and records maintained 
(see 4.2.4). 

NOTE Customer property can include intellectual property. 



7.5.4 Customer Property 

This includes, for example, the documents given by the customer as securities for grant of loans or articles for 
safe custody, etc. Banks have generally given their internal guidelines for maintenance and control of such 
customer property which may be referred for this clause and implemented. 
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7.5.5 Preservation of product 

The organization shall preserve the conformity of product during internal processing and delivery to the 
intended destination. This preservation shall include identification, handling, packaging, storage and protection. 
Preservation shall also apply to the constituent parts of a product. 



7.5.5 Preservation of product 
This may include: 

a) Proper maintenance of record; 

b) Pest control for preservation of security papers; 

c) Maintaining and handling of currency notes; and 

d) Ensuring proper handling, packaging and safe delivery of confidential documents like ATM card, cheque 
book, pass book and other postal delivery, etc. 



7.6 Control of monitoring and measuring devices 

The organization shall determine the monitoring and measurement to be undertaken and the monitoring and 
measuring devices needed to provide evidence of conformity of product to determined requirements, (see 7.2.1) 

The organization shall establish processes to ensure that monitoring and measurement can be carried out and 
are carried out in a manner that is consistent with the monitoring and measurement requirements. 

Where necessary to ensure valid results, measuring equipment shall 

a) be calibrated or verified at specified intervals or prior to use, against measurement standards traceable to 
international or national measurement standards; where no such standards exist, the basis used for 
calibration or verification shall be recorded; 

b) be adjusted or re-adjusted as necessary; 

c) be identified to enable calibration status to be determined; 

d) be safeguarded from adjustments that would invalidate the measurement result; 

e) be protected from damage and deterioration during handling, maintenance and storage. 

In addition, the organization shall assess and record the validity of the previous measuring results when the 
equipment is found not to conform to requirements, The organization shall take appropriate action on the 
equipment and any product affected. Records of the results of calibration and verification shall be maintained. 

(see 4.2.4). 

When used in the monitoring and measurement of specified requirements, the ability of computer software to 
satisfy the intended application shall be confirmed. This shall be undertaken prior to initial use and reconfirmed 
as necessary. 

NOTE See ISO 10012-1 and ISO 10012-2 for guidance. 



7.6 This relates to monitoring and measuring devices being used in the branch office. If there is no such device, 
exclusion can be claimed for this clause. Monitoring device in the branch may include ultraviolet lamp where as 
measuring device may include weighing balance for postal delivery or for gold loan or note counting machine 
for currency. The standard requires that monitoring and measuring device shall be properly installed, maintained 
and controlled more specially the measuring device which shall be calibrated, if system of calibration exists, or 
shall be verified for its proper functioning. Criteria and method of calibration or verification shall be defined and 
proper records shall be maintained. 

8 MEASUREMENT, ANALYSIS AND IMPROVEMENT 



8.1 General 



The organization shall plan and implement the monitoring, measurement, analysis and improvement processes 
needed: 

a) to demonstrate conformity of the product, 
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b) to ensure conformity of the quality management system, and 

c) to continually improve the effectiveness of the quality management system. 

This shall include determination of applicable methods, including statistical techniques, and the extent of 
their use. 



8.1 There is a need to plan the monitoring and/or measuring activities intended to be carried out, which may be 
applied to gauge the following activities: 

a) customer satisfaction, 

b) system performance, 

c) process conformance, and 

d) product and/or service conformance. 

The monitoring and measuring activities would provide data which can be analysed with the help of statistical 
techniques for example histogram, cause and effect diagram, regression analysis, pareto analysis etc. This data 
and analysis can be discussed in management reviews and used as an input for improvement in aforesaid 
areas [8.1 (a) to (d)]. 



8.2 Monitoring and Measurement 
8.2.1 Customer satisfaction 



As one of the measurements of the performance of the quality management system, the organization shall 
monitor information relating to customer perception as to whether the organization has met customer 
requirements. The methods for obtaining and using this information shall be determined. 



8.2 Monitoring and Measurement 
8.2.1 Customer Satisfaction 

There is a need to monitor the performance of the bank with reference to services provided by it to its customers. 
In this regard the bank should device methods by which it can take feedback from the customers relating to the 
various services rendered by it, taking into consideration not only the satisfaction or dissatisfaction aspect of the 
customer but also his perception about the services rendered/ought to be rendered by the bank with respect to his 
stated (or unstated) needs and expectations. This can he done by various methods, which may include: 

a) Telephone calls made periodically to the customers; 

b) Questionnaires and surveys; 

c) Using a market research company; and 

d) Organizing customer meet, etc. 

All the above methods have their merits and demerits. However, it is seen that one can get a realistic response 
from customers when a disclosure of their identities is not stressed. They sometime disclose valuable information, 
which might be in the form of criticism, which can be used to improve the various processes/services of the bank! 
In the case of questionnaires and surveys, it is recommended that the questions should be kept as simple as 
possible and they should be clear and unambiguous. A typical specimen of the questionnaire is given in Annex 
B. An independent cell like customer service cell is normally given this responsibility of getting feedback from 
the customers and thereafter the results of the analysis of customer satisfaction are sent to the relevant branches. 
The customer meet held periodically also helps in finding the measure of satisfaction amongst them. 

Monitoring and measurement of customer satisfaction should be performed on an ongoing basis, the frequency 
of which can be decided by the bank depending upon the size of the bank/branch, nature of the operation, etc, as 
customer's perception also keeps changing with time. It is this customer perception that should be used as a 
measure of the performance of the bank's quality management system in meeting customer requirements. Ideally 
all customers should be monitored. The bank can, however, use their own judgment keeping the following in 
view: 

a) Impact of individual customer on the business, 
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b) to ensure conformity of the quality management system, and 

c) to continually improve the effectiveness of the quality management system. 

This shall include determination of applicable methods, including statistical techniques, and the extent of 
their use. 



8.1 There is a need to plan the monitoring and/or measuring activities intended to be carried out, which may be 
applied to gauge the following activities: 

a) customer satisfaction, 

b) system performance, 

c) process conformance, and 

d) product and/or service conformance. 

The monitoring and measuring activities would provide data which can be analysed with the help of statistical 
techniques for example histogram, cause and effect diagram, regression analysis, pareto analysis etc. This data 
and analysis can be discussed in management reviews and used as an input for improvement in aforesaid 
areas [8.1 (a) to (d)]. 



8.2 Monitoring and Measurement 

8.2.1 Customer satisfaction 

As one of the measurements of the performance of the quality management system, the organization shall 
monitor information relating to customer perception as to whether the organization has met customer 
requirements. The methods for obtaining and using this information shall be determined. 



8.2 Monitoring and Measurement 

8.2.1 Customer Satisfaction 

There is a need to monitor the performance of the bank with reference to services provided by it to its customers. 
In this regard the bank should device methods by which it can take feedback from the customers relating to the 
various services rendered by it, taking into consideration not only the satisfaction or dissatisfaction aspect of the 
customer but also his perception about the services rendered/ought to be rendered by the bank with respect to his 
stated (or unstated) needs and expectations. This can be done by various methods, which may include: 

a) Telephone calls made periodically to the customers; 

b) Questionnaires and surveys; 

c) Using a market research company; and 

d) Organizing customer meet, etc. 

All the above methods have their merits and demerits. However, it is seen that one can get a realistic response 
from customers when a disclosure of their identities is not stressed. They sometime disclose valuable information, 
which might be in the form of criticism, which can be used to improve the various processes/services of the bank. 
In the case of questionnaires and surveys, it is recommended that the questions should be kept as simple as 
possible and they should be clear and unambiguous. A typical specimen of the questionnaire is given in Annex 
B. An independent cell like customer service xell is normally given this responsibility of getting feedback from 
the customers and thereafter the results of the analysis of customer satisfaction are sent to the relevant branches. 
The customer meet held periodically also helps in finding the measure of satisfaction amongst them. 

Monitoring *nd measurement of customer satisfaction should be performed on an ongoing basis, the frequency 
of which can be decided by the bank depending upon the size of the bank/branch, nature of the operation, etc, as 
customer's perception also keeps changing with time. It is this customer perception that should be used as a 
measure of the performance of the bank's quality management system in meeting customer requirements. Ideally 
all customers should be monitored. The bank can, however, use their own judgment keeping the following in 
view: 

a) Impact of individual customer on the business, 
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b) Volume of business expected from the customer, and 

c) Cost, time and efforts, etc. 



The results of customer's satisfaction monitoring and measurement should be addressed in management reviews 
and continual improvement activities shall identify and implement those changes which will improve the customer- 
bank relationship. 



8.2.2 Interna] audit 

The organization shall conduct internal audits at planned intervals to determine whether the quality management 
system 

a) conforms to the planned arrangements (see 7. 1 ), to the requirements of this International Standard and to 
the quality management system requirements established by the organization, and 

b) is effectively implemented and maintained. 

An audit programme shall be planned, taking into consideration the status and importance of the processes 
and areas to be audited, as well as the results of previous audits. The audit criteria, scope, frequency and 
methods shall be defined. Selection of auditors and conduct of audits shall ensure objectivity and impartiality 
of the audit process. Auditors shall not audit their own work. 

The responsibilities and requirements for planning and conducting audits, and for reporting results and 
maintaining records (see 4.2.4) shall be defined in a documented procedure. 

The management responsible for the area being audited shall ensure that actions are taken without undue 
delay to eliminate detected nonconformities and their causes. Follow-up activities shall include the verification 
of the actions taken and the reporting of verification results (see 8.5.2). 
NOTE See ISO .1901 1 for guidance. 



8.2.2 Internal Audit 

The banking industry is well versed with the term 'Audit'. A number of audits are performed periodically in 
banks, like, concurrent audits, statutory audits and internal audits. But all these audits deal with only the 
transactional/operational aspect of the banking business. In contrast, the internal audit referred to here deals with 
the quality aspects of all the functions of the bank so as to ensure conformance to quality management system 
requirements in line with IS/ISO 9001. 

Audits are means of gathering information independently in a planned and systematic manner by various means 
so as to determine whether various processes relating to all the quality related activities undertaken by the branch 
conform to the laid down norms of the bank and all the requirements of the standard and whether these processes 
are being effectively implemented and maintained. One should use the audits to objectively assess that the 
quality management system as laid down is actually doing what it intended to do. It is not sufficient to simply do 
an overview and conclude without any proper basis or supporting evidence that the Quality Management System 
is operating satisfactorily. An auditor shall not audit their own work so as to ensure objectivity and impartiality 
of the audit process. 

The audit process should include: 

a) Frequency of audit; 

b) Planning the audit (for example audit schedule, identification of auditors, scope and objective of audit); 

c) Reviewing the relevant quality management system documentation, and other relevant information (for 
example customer complaints, non-conformities, etc); 

d) Conducting the audit; 

e) Reporting the results; and 

f) Verifying corrective actions taken on non-conformities observed in the previous audit to check their 
effectiveness. 

The audit frequency should be decided keeping in view the following: 

a) Results of the previous audit, 

b) Presence of any complex procedures or processes, 
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c) Any problematic area like customer complaints, and 

d) the quantum of information likely to be available in the area to be audited. 

The responsibility for managing the audit including audit process has to be documented in form of a procedure. 
The actual conduct of audit should include: 

a) Asking questions (preferably open) to the people carrying out the processes (a suitable check list may 
be used); 

b) Observing the processes being carried out; and 

c) Looking at the records and gathering facts/evidences. 

A report or summary of each audit should be made out, listing the findings including non-conformities and 
corrective action taken, if any. It should be simple and unambiguous. If the previous audit recommended or 
required-action to be taken, the effectiveness of the action taken should also be recorded. 

The management responsible for the area being audited should take prompt corrective actions of the non- 
conformities found during the internal audit. The corrective action should include the causes for these non- 
conformities and actions taken for their elimination. This may include: 

a) Writing or revising a procedure or a process control document; 

b) Redesigning the proforma to incorporate more information; 

c) Counseling/education of employees or arranging for training/retraining ofjemployees; and 

d) Reassignment of job, etc. 

The information from the internal audit should also be used for management review. 



8.2.3 Monitoring and measurement of processes 

The organization shall apply suitable methods for monitoring and, where applicable, measurement of the 
quality management system processes. These methods shall demonstrate the ability of the processes to achieve 
planned results. When planned results are not achieved, correction and corrective action shall be taken, as 
appropriate, to ensure conformity of the product. 



8.2.3 Monitoring and Measurement of Processes 

The bank should apply suitable methods for monitoring all the processes identified as necessary for quality 
management systems [see 4.2.1(a)]. The processes could include management related processes, resource 
management processes, product realization processes, and monitoring and measurement processes. The ability 
of the processes to achieve end results needs to be assessed which would mean that quality of the output needs to 
be determined. For each identified process the organization should be able to identify the method of measurement 
and parameters on which the output quality would be measured. Typical banking processes would include general 
administration including training, grant of consumer loans, counter transactions, management of credit and NPA, 
etc. The output of each of these processes should be known and monitored. One of the best ways to ascertain the 
process effectiveness is to assess customer satisfaction levels, for example, speedy and effective disposal of 
customer complaints. Other examples can include checking of the effectiveness of AMC process, HRD process, 
Purchase process, etc. This can bring about improvement in the processes thereby increasing their effectiveness. 
Process maps and flow charts can facilitate the monitoring and measurement of processes. It may be noted that 
the performance of all the processes of the quality management system might not be measurable. For such 
processes, suitable monitoring methods should be implemented and the results recorded. 



8.2.4 Monitoring and measurement of product 

The organization shall monitor and measure the characteristics of the product to verify that product requirements 
have been met. This shall be carried out at appropriate stages of the product realization process in accordance 
with the planned arrangements (see 7.1). 

Evidence of conformity with the acceptance criteria shall be maintained. Records shall indicate the person(s) 
authorizing release of product (see 4.2.4). 

Product release and service delivery shall not proceed until the planned arrangements (see 7.1) have been 
satisfactorily completed, unless otherwise approved by a relevant authority and, where applicable, by the customer. 
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8.2.4 Monitoring and Measurement of Products 

There is a need to establish a system for monitoring and measuring the major characteristics of the products/ 
services provided by the bank with respect to their timeliness, correctness, security, availability of complete 
information, behaviour of staff and ambience. This should be carried out at appropriate stages of the product/ 
service realization process in accordance with the planned arrangements. This would involve checks, cross checks, 
screening and verification during various stages of service realization process like incoming, in-process and final 
stage. For example: 

a) In the case of encashment of cheques, the monitoring and measuring activity could include checking 
correctness of all the entries, verifying the signatures of account holder, ascertaining clear balance 
available in the account timely payment to customer. 

b) In case of loan proposals, prescribed loan application forms duly filled-in and signed by the applicants 
alongwith the relevant documents like financial statements/income tax returns, etc, appraisal note, 
sanction/approval by the competent authority, compliance with terms and conditions of the sanction, 
loan documents relating to primary/collateral security etc. 

c) In case of lockers, proper placement of lockers, verification of storage conditions and other rules as per 
book of instructions. 

d) In case of issuance of a demand draft, checking whether all entries in the demand draft tallies with 
demand draft application forms, affixing signature of the authorized signatory(ies) with their respective 
signature identification number. 

There is a need to check the evidence of conformity as per laid down norms. There is a need to have a consistent 
system of recording the results of the monitoring and measurement activities being undertaken as an objective 
evidence. These can include the records indicating the occurrence of non-conformities and the actions.proposed 
to be taken. 

There is a need for identification of authority who decides that the job is finished. This can mainly be through the 
signature/passwords of authorized person, which ensures that the product/service can be delivered. There is a 
normal practice in the bank that the next stage of service proceeds only after due completion of its earlier stages 
for example in case of receipt of cash, the cashier issues the receipt to the customer only after its proper verification. 
Similarly, the draft issuing personnel prepares the draft only after receipt of duly authorized application form. 
however, it has been observed that in certain situations, particularly in case of reputed customers, the branch 
manager may waive off some of the steps so as to timely deliver the product to the customer. Therefore, in such 
situations, relevant authority should be defined. 



8.3 Control of nonconforming product 

The organization shall ensure that product which does not conform to product requirements is identified and 
controlled to prevent its unintended use or delivery. The controls and related responsibilities and authorities 
for dealing with nonconforming product shall be defined in a documented procedure. 

The organization shall deal with nonconforming product by one or more of the following ways: 

a) by taking action to eliminate the detected nonconformity; 

b) by authorizing its use, release or acceptance under concession by a relevant authority and, where applicable, 
by the customer; 

c) by taking action to preclude its original intended use or application. 

Records of the nature of nonconformities and any subsequent actions taken, including concessions obtained, 
shall be maintained (see 4.2.4). 

When nonconforming product is corrected it shall be subject to re-verification to demonstrate conformity to 
the requirements. 

When nonconforming product is detected after delivery or use has started, the organization shall take action 
appropriate to the effects, or potential effects, of the nonconformity. 
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8.3 Control of Non-conforming Product 

As per the requirement of the standard, there is need to identify product/service and/or system non-conformity, 
the action proposed to be taken, its quarantine arrangements, etc. There is need to keep records of the above. In 
this regard customer feedback including customer complaints play a very vital role in targeting the problem areas 
and effecting improvement in the product/service offered by the bank. 

Depending on the nature of the nonconforming product/service, it should be isolated pending a decision on action 
to be taken. When a nonconforming product and/or service is detected, the following option may be exercised: 

a) Reworking the non-conforming item, for example correcting and authenticating entries made in, say, 
banker's cheques, as per the bank's guidelines; and 

b) Scrapping the non-conforming item and replacing it with a new one. 
Examples'. 

1) cancellation of an earlier DD and issuance of a new DD in its place; 

2) non-issuable currency notes; 

The various non-conforming products in a bank could be availability of: 

a) Series/Si No. of withdrawn security forms like DD, cheque books, pay orders, etc, 

b) Non-isssuable currency notes beyond a stipulated time frame, 

c) Incomplete proposals for grant of loan, 

d) Any deficient service, 

e) Issuance of DD payable at a station/branch which is not authorized for DD payment, and 

f) Off-site payment of diskettes/floppies not being done. 

The various sources of identifying non-conforming products are from customers, various financial audits (internal, 
regular/concurrent), process verification, senior officers visit reports, etc. All these non-conforming products are 
to be suitably identified. These non-conforming products/services have to be controlled so as to prevent their 
unintended use or delivery. This control may include segregation, disposition, and proper recording. The 
segregation of non-conforming product, wherever applicable, may include for example (a) keeping non-conforming 
products in a separate designated area/location, (b) maintaining separate ledgers/folios for non-conforming 
products. The disposition of non-conforming products may include (a) sending soiled currency notes back to 
RBI (b) closure of incomplete proposals/files after due notification to customers and storing them separately. 

There is a need to establish a documented procedure which shall define various activities to be under taken by the 
bank for control of NC products along with relevant responsibilities, associated authorities and related do's (like 
instruction, etc). Record of the nature of non-conformities and any subsequent actions taken, including concessions 
obtained, shall be maintained. 

When a non-conforming products is corrected (for example submission of an application after incorporation of 
all relevant documents), it should be re-checked so as to ensure the above requirements have been complied 
with. There may be certain situations when the non-conforming products is delivered to the customer, (for 
example non-issuable notes delivered to the customer or the DD not complying with the requirements of the 
customer as mentioned in the application), the bank should take immediate appropriate actions. Further, other 
actions, so as to prevent the non-conformity in future, should also be taken {see 8.5.2) taking into account to 
gravity of the effect of non-conformity. 



8.4 Analysis of data 

The organization shall determine, collect and analyse appropriate data to demonstrate the suitability and 
effectiveness of the quality management system and to evaluate where continual improvement of the 
effectiveness of the quality management system can be made. This shall include data generated as a result of 
monitoring and measurement and from other relevant sources. 

The analysis of data shall provide information relating to 

a) customer satisfaction (see 8.2.1), 

b) conformity to product requirements (see 7.2.1), 

c) characteristics and trends of processes and products including opportunities for preventive action, and 

d) suppliers. 
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8.4 Analysis of Data 

The analysis of data is an important tool for detecting trends, potential non-conformities, etc, and rectifying the 
problem even before its actual occurrence. It is an important activity which can result in possible improvement in 
the quality management system of the bank, its processes and ultimately in services provided by the Bank. 

Mere collection of data and information, in itself, is not sufficient and has no meaning, if it is not examined, 
evaluated, analyzed in a meaningful way resulting in decision-making. This data may be generated from various 
sources like: 

a) Customer feed back/ complaints, 

b) Internal inspection/concurrent/ statutory audit findings and RBI inspection (as applicable), 

c) Performance evaluation (achievement vs target), 

d) Market information, 

e) Effectiveness of training, 

f) Data relating to monitoring and measurement of products and processes, 

g) Internal/external quality system audits, 

h) Periodic statements/returns submitted by the branch, and 

j) Data from suppliers and outsourced service, customers, number of breakdown of various machines 
(like ATMs, note-counting M/c, passbook printers, computers). 

The various statistical tools which can be used for analysis of data includes cause and effect diagram, Pareto 
diagram, data collection forms, Histograms, regression analysis, trend analysis, bench marking, etc. 

The data should be collected on a suitably designed format to facilitate collection of all the available information 
including identity of personnel, wherever required, and serve the purpose of suitable analysis. For this purpose, 
relevant Indian Standard should be used. 

The results of the analysis of the above data can highlight the problematic area and thereafter actions to be taken 
for their rectification and further improvement. The results of such analysis will provide information for: 

a) Determining level of customer satisfaction, 

b) Clause wise/department wise non-conformity identification, 

c) Degree of conformance to quality management system, 

d) Determining achievement of quality objectives and their further review, 

e) Determining effectiveness and efficiency of processes including bench marking, and 

f) Identifying opportunities for preventive actions. 

The results of such analysis can also be used as: 

a) Input to the management review, 

b) Input to decision processes for corrective and preventive actions, 

c) Input to assessing customer satisfaction, and 

d) Evidence of conformance to customer requirements and quality management systernrequirements. 

Statistical techniques are useful tools for the analysis process. Besides, the above four areas, the data analysis can 
be applied to any other area as well. 



8.5 Improvement 

8.5.1 Continual improvement 

The organization shall continually improve the effectiveness of the quality management system through the 
use of the quality policy, quality objectives, audit results, analysis of data, corrective and preventive actions 
and management review. 



8.5 Improvement 

8.5.1 Continual Improvement 

Continual improvement rs a process by which the improvement is done as a step-by-step activity on a recurring 
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basis to implement agreed solutions for achieving positive benefits. There is a need to identify areas for effecting 
continual improvement based on the evaluation of performance/achievement through the use of quality policy 
and quality objectives, audit results, customer's satisfaction, results of data analysis, results of management 
reviews and corrective and preventive actions and also experience gained, technological development, etc. Such 
improvements shall be visibly demonstrated. However, there is a need to prioritize the various activities for their 
implementation based on the availability of resources and organizational considerations. 

The process of improvement includes a number of steps, such as: 

a) Identification of potential opportunities to improve the quality management system, 

b) Analysis and justification to implement an improvement action, 

c) Implementation of the most appropriate solution (based on corrective and preventive actions), 

d) Measurement of the impact of the improvement, and 

e) Formalizing the necessary changes in processes/systems. 

The results of the improvement process should form part of the management reviews. For further guidance on 
process for continual improvement reference may be made to IS/ISO 9004. 

Examples of areas where the quality management system can be improved may include: 

a) Service delivery process (for example improvement in time taken for banking transactions, etc); 

b) Internal communications (for example system of internal circulation, availability and circulation of 
circulars specially those received from HO/ZO/RO, system of job assignment); 

-c) Follow-up activities (for example strengthening of follow up procedures for collection, NPA account, 
etc); 

d) Procedures/work instructions/formats; 

e) Effectiveness of management review meetings; 

f) Customer feedback system including customer grievance redressal systems (for example surveys, 
questionnaire, interaction with customer, etc); 

g) Training programmes (for example both internal and external); 

h) House-keeping (for example maintenance and retrievability of records, circulars, balancing of books, 
etc); 

j) Productivity of resources; and 

k) Identification and elimination of waste processes/activities. 



8.5.2 Corrective action 

The organization shall take action to eliminate the cause of nonconformities in order to prevent recurrence. 
Corrective actions shall be appropriate to the effects of the nonconformities encountered. 

A documented procedure shall be established to define requirements for 

a) reviewing nonconformities (including customer complaints), 

b) determining the causes of nonconformities, 

c) evaluating the need for action to ensure that nonconformities do not recur, 

d) determining and implementing action needed, 

e) records of the results of action taken (see 4.2.4), and 

f) reviewing corrective action taken. 



8.5.2 Corrective Action 

Corrective action is an important improvement activity. The need for corrective action can arise when an internal 
non-conformity (product, service or quality management system) occurs, or from external sources such as customer 
complaints, problems with suppliers, etc. 

It seeks to eliminate permanently the causes and consequent effects of problems that could have a negative 
impact on: 

a) Performance of the bank, 
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b) On the bank's products/services, processes, quality management system, or 

c) Customer satisfaction, and 

d) Relationship with suppliers, etc. 

The corrective action process involves prioritization of identified non-conformities (using for example Pareto 
diagram) so as to take timely and appropriate corrective action on 'vital few' non-conformities. The root causes 
of the prioritized non-conformities should be identified using for example cause and effect diagram, brain storming 
etc. However, once the non-conformity is identified, wherever possible, immediate correction (removal of that 
non-conformity) should be applied to prevent the continued effects of the non-conformity, before corrective 
action is taken and implemented for a long term solution. 

There is a need to establish a time frame during which the proposed corrective action should be completed for 
which appropriate resources should be allocated. The effectiveness of corrective action taken should be evaluated. 
If the corrective action are effective, there might be a need to revise the quality management system. However, 
if the corrective actions are ineffective, there may be a need to relook into other possible causes for the non- 
conformity and appropriate corrective action. It may be emphasized that the process of corrective action is 
complete only when it is effective. There shall be a documented procedure giving description of the above 
methodology for corrective action including responsibility and authorities. 

While taking corrective action it is also imperative to keep in view that the corrective action taken in one area 
does not have adverse effect on the working of another area. 



8.5.3 Preventive action 



The organization shall determine action to eliminate the causes of potential nonconformities in order to prevent 
their occurrence. Preventive actions shall be appropriate to the effects of the potential problems. 

A documented procedure shall be established to define requirements for 

a) determining potential nonconformities _and their causes, 

b) evaluating the need for action to prevent occurrence of nonconformities, 

c) determining and implementing action needed, 

d) records of results of action taken (see 4.2.4), and 

e) reviewing preventive action taken. 



8.5.3 Preventive Action 

Preventive action is another important improvement activity which seeks to prevent the occurrence of the potential 
problems that could have a negative effect on the banks' working its product/services, processes, quality 
management system in relationship with suppliers customer satisfaction etc. A documented procedure describing 
implementation and execution of the preventive action activity shall be established. In this regard, the analysis of 
data provides important inputs by reflecting trends in performance parameters, processes, etc, which can help in 
controlling them well before the potential problem becomes a non-conformity. 

The results of preventive action shall be recorded. The process for preventive action is similar to that for corrective 
action. The preventive actions may include: 

a) Use of password for locker operations and day-end locker inspection; 

b) Sending letter of thanks to the introducer of an new account; 

c) Planned preventive maintenance for equipment like PCs, ACs, etc; 

d) Mistake proof techniques like checklist, programme software, etc; 

e) Punching of draft, fixation of tixo-tapes on the amount on draft to prevent material alteration; 

f) Periodical changes in TT codes; and 

g) Periodical changes in password usages. 

It is essential, in this regard, that adequate resources be made available so as to ensure that preventive action 
activities are implemented. The implementation of preventive action should be carefully considered and planned 
to ensure that the effects of preventive actions taken in one area do not cause adverse effect in other areas of the 
organization. 
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ANNEX A 
(Clause 6.2.2) 

COMPETENCE MATRIX 

(Siiggestive) 



Date of Evaluation. 



Strictly for internal branch management and 
has no relation to career plan/development 



in 



o 
o 



Periodicity: Half Yearly 
Next Evaluation due on . 



Objective: 

1) To determine job allocation for efficient 
services. 

2) T6 assess training needs. 



ON 



SI 
No. 


Name of 
Staff 


Desig- 
nation 


Work 
Experience 


Exposure 

Department 

Handled 
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Powers 


Quali- 
fications 
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Traits 


Job 
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Past 
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Potential 


Total 


Level of 
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Remarks 
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GUIDELINES FOR COMPETENCE MATRIX 



SI No. 


Criteria 


Particulars 


Criteria Consideration 





Work experience 


More than 5 years 
>2 to 5 years 
up to 2 years 


10 
8 
6 


Years of satisfactory work experience at the existing designation 
level 


ii) 


Exposure (departments handled) 


All routine operations and loans 
Routine operation or loans 
Part routine and part loan 
Part routine or part loan 


16 
8 
7 
6 


For officer/clerk 
Routine or loan 
For sub staff 
Related duties 


iii) 


Delegated powers (in case of officers) 


Full judicious use of powers 
Part use of powers 


10 
7 


Not applicable in case of non-supervisory staff 


iv) 


Qualification (minimum for the cadre) 


Minimum satisfied 
Not satisfied 


10 
6 


Officers: Graduation 
Clerk: Matriculation 
Sub staff: Under matriculation 


v) 


Personal traits 


Good 
Average 
Below average 


10 

7 
4 


Includes initiative. Communication ability 

efficiency, public dealing, leadership, customer dealing 


vi) 


Job knowledge 


Good 
Average 
Below average 


10 

7 
4 


Any adverse feature reflected in inspection 
report, customer feed back, etc 


vii) 


Skills 


Good 
Average 
Below average 


10 
7 
4 


Supervisory skills for officers, operational skills for support staff 
(clerks and sub staff). Factors like speed, Accuracy, efficiency, etc 
may be considered 


viii) 


Past performance 


Good 
Average 
Below average 


10 

7 
4 


Track record, performance grading/rating. 

Adverse features, if ariy, on account of customer complaint, 

disciplinary cases (if any) 


ix) 


Potential 


Good 
Average 
Below average 


10 
8 
4 


Additional qualifications 

Carrier progression 

General knowledge and exposure 



in 



l) Criteria considered are broad and may depend on the Cadre being considered. 
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COMPETENCE LEVEL EVALUATION CRITERIA 



Category 


Grade 


Marks 


(1) 


(2) 


(3) 


For supervisory (officer and special assistant) 
staff (out of 90) 


High 

Average 

Low 


Above 80 

> 50 up to 80 

> up to 50 


For supporting staff (Clerk and sub staff) 
(out of 80) 


High 

Average 

Low 


Above 70 

> 45 up to 70 

> up to 45 



NOTE — Branch Head will assess competence level of staff strictly for internal branch management and will use it for specific 
purpose of job rotation and assessment of training needs. This assessment is strictly internal to the branch and has no link to 
corporate career plan/progression. 
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